5 ms·

> The vulnerabilities are found in Qualcomm’s software drivers that come with its chipsets. Pre-installed on devices at the point of manufacturing, these vulner

by gregmac 10y ago

> The vulnerabilities are found in Qualcomm’s software drivers that come with its chipsets. Pre-installed on devices at the point of manufacturing, these vulnerable drivers can only be fixed by installing a patch from the distributor or carrier. Distributors and carriers can only issue patches after receiving fixed driver packs from Qualcomm. > The research team provided Qualcomm with information about the vulnerabilities in April 2016. The team then followed the industry-standard disclosure policy (CERT/CC policy) of allowing 90 days for patches to be produced before disclosing these vulnerabilities to the public. > Qualcomm reviewed these vulnerabilities, classified each as high risk, and confirmed that it released patches to original equipment manufacturers (OEMs). The complexity of this is really a problem for security updates. It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer.. While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.

ac29 10y ago
>I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today. There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates. I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't. [0] https://source.android.com/security/bulletin/2016-07-01.html https://source.android.com/security/bulletin/2016-07-01.html [1] https://source.android.com/security/bulletin/2016-08-01.html https://source.android.com/security/bulletin/2016-08-01.html
- icc97 10y ago
  I'm on a Nexus 5, can I take it there's basically nothing we can do until Google push out patches.
  - kuschku 10y ago
    Correct, because you don’t even have the required data to fix the device, and instead are fully dependent on someone else. A someone which has been proved to be unreliable again and again.
    - ac29 10y ago
      Wrong. See my other post. Google provides OTA patches for manual installation.
      - kuschku 10y ago
        Ah, so I have the source code for the kernel to patch it manually? I have the source for the firmware to patch that manually, too? You are still proposing I run proprietary software that can be abandoned at any time, and where I have no way to continue fixing it if it is abandoned. We’ve seen that with several Nexus devices before, the chipmaker abandoned the SoC, Google couldn’t fix issues because of that, and we didn’t get OTAs from anyone to fix things.
    - danudey 10y ago
      Better 'a someone' on the Nexus 5 than 'a series of someones' (e.g. Qualcomm, Google, HTC, and Verizon) on any non-Nexus phone, only some of which have any vested interest in getting you those updates.
      - kuschku 10y ago
        Best to be the owner on your own device. There’s a reason we modularized drivers on other systems, which allows people to customize the OS however they want it, because the firmware, drivers, main OS, UI layer of OS, and applications are all properly seperated.
  - ac29 10y ago
    OTA's are available here: https://developers.google.com/android/nexus/ota https://developers.google.com/android/nexus/ota
- ac29 10y ago
  August patch was pushed to my 5X a few hours later, and as expected one vulnerability was fixed, one isnt.
kuschku 10y ago
The issue is not that OEMs and carriers add custom stuff. The issue is the interdependence between those modules, and that they can’t be updated seperately. Why can’t the OEM customizations be pre-installed apps updated through a third-party app store? Why can’t the OS be split into parts, with a driver part where the drivers can be updated, and a higher level part being updated by Google or Amazon? Such a seperation would solve all these issues, without anyone – except Google – losing.

by gregmac 10y ago

ac29 10y ago

>I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today. There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates. I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't. [0] https://source.android.com/security/bulletin/2016-07-01.html https://source.android.com/security/bulletin/2016-07-01.html [1] https://source.android.com/security/bulletin/2016-08-01.html https://source.android.com/security/bulletin/2016-08-01.html

icc97 10y ago
I'm on a Nexus 5, can I take it there's basically nothing we can do until Google push out patches.
- kuschku 10y ago
  Correct, because you don’t even have the required data to fix the device, and instead are fully dependent on someone else. A someone which has been proved to be unreliable again and again.
  - ac29 10y ago
    Wrong. See my other post. Google provides OTA patches for manual installation.
    - kuschku 10y ago
      Ah, so I have the source code for the kernel to patch it manually? I have the source for the firmware to patch that manually, too? You are still proposing I run proprietary software that can be abandoned at any time, and where I have no way to continue fixing it if it is abandoned. We’ve seen that with several Nexus devices before, the chipmaker abandoned the SoC, Google couldn’t fix issues because of that, and we didn’t get OTAs from anyone to fix things.
  - danudey 10y ago
    Better 'a someone' on the Nexus 5 than 'a series of someones' (e.g. Qualcomm, Google, HTC, and Verizon) on any non-Nexus phone, only some of which have any vested interest in getting you those updates.
    - kuschku 10y ago
      Best to be the owner on your own device. There’s a reason we modularized drivers on other systems, which allows people to customize the OS however they want it, because the firmware, drivers, main OS, UI layer of OS, and applications are all properly seperated.
- ac29 10y ago
  OTA's are available here: https://developers.google.com/android/nexus/ota https://developers.google.com/android/nexus/ota
ac29 10y ago
August patch was pushed to my 5X a few hours later, and as expected one vulnerability was fixed, one isnt.

kuschku 10y ago

The issue is not that OEMs and carriers add custom stuff. The issue is the interdependence between those modules, and that they can’t be updated seperately. Why can’t the OEM customizations be pre-installed apps updated through a third-party app store? Why can’t the OS be split into parts, with a driver part where the drivers can be updated, and a higher level part being updated by Google or Amazon? Such a seperation would solve all these issues, without anyone – except Google – losing.